Prosím o kontrolu logu.

[atharix]

Logfile of random's system information tool 1.06 (written by random/random)
Run by Joe at 2010-03-06 17:56:50
Systém Microsoft Windows XP Professional Service Pack 2
System drive C: has 13 GB (45%) free of 30 GB
Total RAM: 2047 MB (66% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:56:56, on 6.3.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\oodag.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\wbem\wmiapsrv.exe
C:\Program Files\FlashGet\flashget.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Joe\Plocha\RSIT.exe
C:\Program Files\trend micro\Joe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Odkazy
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: RecFree Toolbar - {0508F8F1-08E3-43EE-AAA8-09AD09803084} - (no file)
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Flashget] C:\Program Files\FlashGet\flashget.exe /min
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Stáhnout &vše FlashGetem - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Stáhnout FlashGetem - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xportovat do aplikace Microsoft Office Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Zdroje informací - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\System32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 4161 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}]
FGCatchUrl - C:\Program Files\FlashGet\jccatch.dll [2007-06-29 94308]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-18 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-18 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}]
FlashGet GetFlash Class - C:\Program Files\FlashGet\getflash.dll [2007-05-16 163840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0508F8F1-08E3-43EE-AAA8-09AD09803084} - []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"=C:\Program Files\Eset\nod32kui.exe [2009-10-15 949376]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"UserFaultCheck"=C:\WINDOWS\system32\dumprep 0 -u []
"Flashget"=C:\Program Files\FlashGet\flashget.exe [2007-06-29 1990704]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe [2004-08-17 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
C:\Program Files\D-Tools\daemon.exe [2004-08-22 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DelReg]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
C:\WINDOWS\System32\oodtray.exe [2007-05-11 2512392]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe [2009-06-25 1414144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe [2009-09-05 417792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegDoctor]
C:\Program Files\RegDoctor\RegDoctor.exe [2005-11-30 2260992]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2004-11-02 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteVacuum]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
D:\Program Files\Valve\Steam\Steam.exe -silent []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-18 149280]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2009-08-14 155648]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\FlashGet\FlashGet.exe"="C:\Program Files\FlashGet\FlashGet.exe:*:Enabled:Flashget"
"D:\Program Files\Valve\Steam\SteamApps\atharix\counter-strike\hl.exe"="D:\Program Files\Valve\Steam\SteamApps\atharix\counter-strike\hl.exe:*:Enabled:Half-Life Launcher"
"C:\Documents and Settings\Joe\Plocha\Strong DC++\StrongDC.exe"="C:\Documents and Settings\Joe\Plocha\Strong DC++\StrongDC.exe:*:Enabled:StrongDC++"
"D:\Strong DC++\StrongDC.exe"="D:\Strong DC++\StrongDC.exe:*:Enabled:StrongDC++"
"D:\GPGNet\GPG.Multiplayer.Client.exe"="D:\GPGNet\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander - Forged Alliance"
"C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe"="C:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander - Forged Alliance"
"D:\Program Files\THQ\Gas Powered Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe"="D:\Program Files\THQ\Gas Powered Games\Supreme Commander - Forged Alliance\bin\ForgedAlliance.exe:*:Enabled:Supreme Commander - Forged Alliance"
"D:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe"="D:\Program Files\THQ\Gas Powered Games\GPGNet\GPG.Multiplayer.Client.exe:*:Enabled:GPGNet - Supreme Commander - Forged Alliance"
"C:\Program Files\SPSSInc\Statistics17\statistics.exe"="C:\Program Files\SPSSInc\Statistics17\statistics.exe:*:Disabled:Statistics17:exe"
"C:\Program Files\SPSSInc\Statistics17\statistics.com"="C:\Program Files\SPSSInc\Statistics17\statistics.com:*:Disabled:Statistics17:com"
"C:\Program Files\SPSSInc\Statistics17\SPSSWinWrapIDE.exe"="C:\Program Files\SPSSInc\Statistics17\SPSSWinWrapIDE.exe:*:Disabled:SPSS Basic Script Editor"
"D:\Program Files\Valve\Steam\Steam.exe"="D:\Program Files\Valve\Steam\Steam.exe:*:Enabled:Steam 732897"
"D:\KKND Xtreme\KKND Xtreme.EXE"="D:\KKND Xtreme\KKND Xtreme.EXE:*:Enabled:KKND Xtreme"
"C:\Program Files\QIP\qip.exe"="C:\Program Files\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:Run a DLL as an App"
"C:\Program Files\Hamachi\hamachi.exe"="C:\Program Files\Hamachi\hamachi.exe:*:Disabled:Hamachi Client"
"D:\Starcraft\StarCraft.exe"="D:\Starcraft\StarCraft.exe:*:Enabled:Starcraft"
"C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe"="C:\Program Files\Nokia\Nokia Software Updater\nsu_ui_client.exe:*:Enabled:Nokia Software Updater"
"C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe"="C:\Program Files\Common Files\Nokia\Service Layer\A\nsl_host_process.exe:*:Enabled:Nokia Service Layer Host Process "
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a4e321b2-05a2-11df-b06a-000c761904a0}]
shell\AutoRun\command - J:\__DTMEDIA\DTMedia.exe


======List of files/folders created in the last 1 months======

2010-03-06 17:56:50 ----D---- C:\rsit
2010-03-06 17:56:50 ----D---- C:\Program Files\trend micro
2010-02-15 13:56:10 ----D---- C:\Documents and Settings\Joe\Data aplikací\BSplayer Pro
2010-02-15 13:56:10 ----D---- C:\Documents and Settings\Joe\Data aplikací\BSplayer

======List of files/folders modified in the last 1 months======

2010-03-06 17:56:50 ----RD---- C:\Program Files
2010-03-06 17:55:02 ----D---- C:\Program Files\FlashGet
2010-03-06 17:54:25 ----D---- C:\WINDOWS\Prefetch
2010-03-06 17:47:58 ----D---- C:\WINDOWS\system32
2010-03-06 17:47:17 ----D---- C:\WINDOWS\system32\drivers
2010-03-06 17:45:02 ----D---- C:\WINDOWS\Temp
2010-03-06 17:42:35 ----D---- C:\Program Files\Mozilla Firefox
2010-03-06 17:41:50 ----A---- C:\WINDOWS\ErrRegDoc.txt
2010-03-06 17:40:59 ----D---- C:\WINDOWS
2010-03-06 17:20:01 ----A---- C:\WINDOWS\NeroDigital.ini
2010-03-06 10:51:38 ----D---- C:\WINDOWS\system32\CatRoot2
2010-03-06 02:12:51 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-03-05 01:12:39 ----D---- C:\Documents and Settings\Joe\Data aplikací\Skype
2010-03-05 00:32:16 ----D---- C:\Documents and Settings\Joe\Data aplikací\skypePM
2010-02-24 22:03:30 ----D---- C:\Program Files\Common Files\Blizzard Entertainment
2010-02-13 15:37:40 ----SD---- C:\Documents and Settings\Joe\Data aplikací\Microsoft

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdPPM;Ovladač procesoru HwPState AMD; C:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 33792]
R1 nod32drv;nod32drv; C:\WINDOWS\system32\drivers\nod32drv.sys [2009-10-15 15424]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\System32\DRIVERS\wmiacpi.sys [2004-08-03 8832]
R1 WS2IFSL;Podpůrné prostředí zprostředkovatele služeb Windows Socket 2.0 bez podpory IFS; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2001-10-25 12032]
R2 AMON;AMON; C:\WINDOWS\system32\drivers\amon.sys [2009-10-15 512096]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-08-14 4485632]
R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-23 26176]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\System32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Ovladač třídy standardu HID; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-10-25 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-04-17 4707328]
R3 mouhid;Ovladač myši standardu HID; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-10-25 12160]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2009-05-25 142336]
R3 usbehci;Ovladač miniportu rozšířeného radiče hostitele Microsoft USB 2.0; C:\WINDOWS\System32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Rozbočovač umožnující USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbohci;Ovladač Miniport otevřeného hostitelského řadiče Microsoft USB; C:\WINDOWS\System32\DRIVERS\usbohci.sys [2004-08-03 17024]
S3 Ambfilt;Ambfilt; C:\WINDOWS\system32\drivers\Ambfilt.sys [2008-08-05 1684736]
S3 cpuz130;cpuz130; \??\C:\DOCUME~1\Joe\LOCALS~1\Temp\cpuz130\cpuz_x32.sys []
S3 CrystalSysInfo;CrystalSysInfo; \??\C:\Program Files\MediaCoder\SysInfo.sys []
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 GMSIPCI;GMSIPCI; \??\F:\INSTALL\GMSIPCI.SYS []
S3 Monfilt;Monfilt; C:\WINDOWS\system32\drivers\Monfilt.sys [2006-01-04 1389056]
S3 MSICDSetup;MSICDSetup; \??\F:\CDriver.sys []
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2009-02-09 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2009-02-09 22016]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent; C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2009-03-19 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic; C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2009-03-19 8320]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2009-02-09 7808]
S3 usbprint;Třída USB Printer; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 usbscan;Ovladač skeneru USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2004-08-03 25600]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2009-02-09 7808]
S3 USBSTOR;Ovladač velkokapacitního paměťového zařízení USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-08-14 602112]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Program Files\LogMeIn Hamachi\hamachi-2.exe [2009-10-29 1074568]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-10-18 153376]
R2 NOD32krn;NOD32 Kernel Service; C:\Program Files\Eset\nod32krn.exe [2009-10-15 552064]
R2 O&O Defrag;O&O Defrag; C:\WINDOWS\System32\oodag.exe [2007-05-11 1050120]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-11 38912]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-08-13 593920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632]
S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-12-13 447784]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2009-06-02 637952]

-----------------EOF-----------------

[Caroprd111]

Zdravím

Na logu se pracuje, prosím o strpení.

[Caroprd111]

Doporučuji odinstalovat:
D:\Strong DC++\StrongDC.exe

P2P sítě a jejich klienti jsou potenciálním bezpečnostním rizikem, prakticky neustále jsou zdrojem virů, zbytečně se vystavujete riziku.



Stáhněte Ccleaner http://viry.cz/forum/viewtopic.php?t=7478

• Nainstalujte a v průběhu instalace odškrtněte, že chcete instalovat yahoo toolbar.
  
  Záložka Čistič
• Dejte analyzovat, po dokončení dejte Spustit Ccleaner.
  
  Záložka Registry
• Klikněte na Hledej problémy, po dokončení klikněte na Opravit problémy, zálohu dělat nemusíte, potom dejte Opravit všechny problémy.
  OK Zavřít

Doinstalujte SP3 http://www.viry.cz/forum/viewtopic.php?f=46&t=86100


V logu nevidím firewall, doinstalujte Přehled: http://www.viry.cz/forum/viewtopic.php?f=41&t=6523


Jsou s PC nějaké problémy

[atharix]

DC++ používám řadu let nikdy žádný problém, jde o to umět používat.
CC Cleaner pravidelně používám.
SP3 doinstaluji, firewall uvažuji nad zonealarm, s keriem mám špatné zkušenosti.

Tak zvláštního se neděje nic jen procesor občas zadrhává, proto se chci pojistit, již jsem to projel i na rootkity a našlo mi asi 10 odkazů hodím to do dané sekce.

Děkuji.

[Caroprd111]

Pokračujte zde.

[atharix]

Vkládám tedy log z rootkit revealeru. Když spustím GMER tak mi vyhodí windows chybu. To asi není normální že?:)

HKU\S-1-5-21-1390067357-343818398-839522115-1003\Software\SecuROM\!CAUTION! NEVER DELETE OR CHANGE ANY KEY* 18.10.2009 16:22 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAC* 15.10.2009 18:43 0 bytes Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI* 15.10.2009 18:43 0 bytes Key name contains embedded nulls (*)
HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed 15.3.2010 10:03 80 bytes Data mismatch between Windows API and raw hive data.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System* 15.10.2009 18:51 0 bytes Key name contains embedded nulls (*)
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf40 8.3.2010 23:45 0 bytes Hidden from Windows API.
HKLM\SYSTEM\ControlSet001\Services\d347prt\Cfg\0Jf41 8.3.2010 23:45 0 bytes Hidden from Windows API.

[Caroprd111]

Zkuste Gmer přejmenovat (cokoliv.com) a spustit v nouzovém režimu.

[atharix]

Gmer přejmenován spuštěn v nr a vyhazuje windows vyjímku po začátku běhu asi 10s
AppName: cokoli.com AppVer: 1.0.15.15281 ModName: cokoli.com
ModVer: 1.0.15.15281 Offset: 0005c887

Počítač jsem projel spyware terminatorem a našel následující

trojan.spy.535539 (trojan)

backdoor.IRCbot.bze (backdoor)

obojí odstraněno.

Počítač jede hůř než dříve, nainstaloval jsem SP3,zonealarm,spyware terminator, používám NOD32.

[Caroprd111]

Stáhněte a uložte, nejlépe na plochu http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Vypněte všechny rezidentní bezpečnostní programy - firewally, antiviry, antispywary

Spusťte aplikaci pod účtem s oprávněním Administrátora (Správce), ihned po startu se zobrazí stránka s licenčními podmínkami, pokračujte stisknutím tlačítka "Ano"

Dále postupujte dle pokynů, během scanu nespouštějte jiné aplikace a neklikejte do zobrazujícího se okna

Scan by měl trvat okolo 5 - 10 minut, po dokončení Combofix zobrazí log C:\ComboFix.txt , který sem vložte.

Během skenování může být počítač restartován.

[atharix]

nod32 Jsem ukončil po tom upozorvnění. Ačkoli je zde uveden vše bylo vyplé ručně.

ComboFix 10-03-15.04 - Joe 16.03.2010 9:56.1.3 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1629 [GMT 1:00]
Spuštěný z: c:\documents and settings\Joe\Plocha\ComboFix.exe
AV: Eset NOD32 Antivirus 2.70 *On-access scanning enabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Rezidentní štít AV je zapnutý

.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\etc\lmhosts
c:\windows\system32\ieuinit.inf

.
((((((((((((((((((((((((( Soubory vytvořené od 2010-02-16 do 2010-03-16 )))))))))))))))))))))))))))))))
.

2010-03-15 11:40 . 2010-03-15 11:40 -------- d-----w- c:\windows\system32\oodag
2010-03-15 10:52 . 2008-04-14 07:51 136192 ------w- c:\windows\system32\aaclient.dll
2010-03-15 10:47 . 2008-04-14 07:51 33792 -c----w- c:\windows\system32\dllcache\custsat.dll
2010-03-15 10:44 . 2008-04-13 23:10 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys
2010-03-15 09:45 . 2010-03-15 09:45 -------- d-----w- c:\program files\Zone Labs
2010-03-15 09:45 . 2010-03-16 08:58 -------- d-----w- c:\windows\Internet Logs
2010-03-15 09:23 . 2010-03-15 09:23 -------- d--h--w- c:\windows\PIF
2010-03-15 09:05 . 2010-03-15 09:05 -------- d-----r- c:\documents and settings\LocalService\Dokumenty
2010-03-14 19:37 . 2010-03-15 00:45 -------- d-----w- c:\program files\WinClamAVShield
2010-03-14 19:30 . 2010-03-14 19:30 -------- d-----w- c:\program files\Crawler
2010-03-14 19:30 . 2010-03-14 19:30 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-03-14 19:29 . 2010-03-15 09:53 -------- d-----w- c:\program files\Spyware Terminator
2010-03-08 22:49 . 2010-03-14 21:53 211893 ----a-w- c:\windows\system32\drivers\IsDrv122.sys
2010-03-08 22:44 . 2010-03-08 22:44 94480 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-03-06 16:56 . 2010-03-12 22:53 -------- d-----w- c:\program files\trend micro
2010-03-06 16:56 . 2010-03-06 16:56 -------- d-----w- C:\rsit

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-16 08:50 . 2009-10-15 17:49 -------- d-----w- c:\program files\ESET
2010-03-16 08:40 . 2010-03-16 08:54 8704 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-03-16 08:40 . 2010-03-15 11:10 1550490 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-03-15 23:15 . 2010-03-16 08:40 103424 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-03-15 21:04 . 2001-10-25 12:00 68940 ----a-w- c:\windows\system32\perfc005.dat
2010-03-15 21:04 . 2001-10-25 12:00 389994 ----a-w- c:\windows\system32\perfh005.dat
2010-03-15 10:55 . 2009-10-15 17:30 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-03-15 10:55 . 2009-10-15 17:30 3038 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-03-15 10:34 . 2009-10-15 19:16 -------- d-----w- c:\program files\FlashGet
2010-03-15 09:48 . 2010-03-15 09:48 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-02-24 21:03 . 2009-11-01 09:45 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-25 00:25 . 2009-10-15 17:57 -------- d-----w- c:\program files\QuickTime
2010-01-25 00:25 . 2010-01-25 00:25 -------- d-----w- c:\program files\Common Files\Apple
2010-01-25 00:25 . 2010-01-25 00:25 -------- d-----w- c:\program files\Apple Software Update
2010-01-19 17:02 . 2009-10-31 10:38 -------- d-----w- c:\program files\Common Files\Nokia
2010-01-19 17:02 . 2009-10-31 10:38 -------- d-----w- c:\program files\Nokia
2010-01-19 17:02 . 2010-01-19 17:02 -------- d-----w- c:\program files\MSXML 6.0
2009-12-17 00:47 . 2009-12-17 00:42 967 ----a-w- c:\windows\ScUnin.pif
2009-12-17 00:47 . 2009-12-17 00:42 94208 ----a-w- c:\windows\ScUnin.exe
2009-12-17 00:47 . 2009-12-17 00:42 27961 ----a-w- c:\windows\scunin.dat
2009-04-07 18:52 . 2009-04-07 18:52 28672 ----a-w- c:\program files\mozilla firefox\components\GooglePlusVideosXPCOM.dll
2008-10-19 09:58 . 2008-10-19 09:58 49152 ----a-w- c:\program files\mozilla firefox\components\SiteVacuumXPCOM.dll
2009-08-09 21:14 . 2009-08-09 21:14 49152 ----a-w- c:\program files\mozilla firefox\components\SuperSearchXPCOM.dll
2008-08-16 16:42 . 2008-08-16 16:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 16:42 . 2008-08-16 16:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 16:42 . 2008-08-16 16:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 16:42 . 2008-08-16 16:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 16:43 . 2008-08-16 16:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 16:42 . 2008-08-16 16:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 16:42 . 2008-08-16 16:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 07:41 . 2008-05-21 07:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 07:41 . 2008-05-21 07:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 07:41 . 2008-05-21 07:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 12:58 . 2008-06-05 12:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 16:42 . 2008-08-16 16:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.

(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-10-15 949376]
"SpywareTerminator"="c:\program files\Spyware Terminator\SpywareTerminatorShield.exe" [2010-03-14 2166784]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DelReg
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiteVacuum
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 10:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 02:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 07:52 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
2004-08-22 15:05 81920 ----a-w- c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
2007-06-29 11:44 1990704 ----a-w- c:\program files\FlashGet\flashget.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 13:57 153136 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2007-05-11 00:08 2512392 ----a-w- c:\windows\system32\oodtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-25 14:12 1414144 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 00:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegDoctor]
2005-11-30 16:31 2260992 ----a-w- c:\program files\RegDoctor\RegDoctor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2010-03-14 19:30 2166784 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
2010-03-14 19:30 3037696 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-18 22:52 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\FlashGet\\FlashGet.exe"=
"d:\\Strong DC++\\StrongDC.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [15.10.2009 18:55 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [15.10.2009 18:55 5248]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [15.10.2009 18:50 15424]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [14.3.2010 20:30 142592]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [29.10.2009 12:27 1074568]
S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.sys --> c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [15.10.2009 18:39 1684736]
S3 CEMXKDEP;CEMXKDEP;c:\docume~1\Joe\LOCALS~1\Temp\CEMXKDEP.exe --> c:\docume~1\Joe\LOCALS~1\Temp\CEMXKDEP.exe [?]
S3 cpuz130;cpuz130;\??\c:\docume~1\Joe\LOCALS~1\Temp\cpuz130\cpuz_x32.sys --> c:\docume~1\Joe\LOCALS~1\Temp\cpuz130\cpuz_x32.sys [?]
S3 HFVKRQU;HFVKRQU;c:\docume~1\Joe\LOCALS~1\Temp\HFVKRQU.exe --> c:\docume~1\Joe\LOCALS~1\Temp\HFVKRQU.exe [?]
S3 MSICDSetup;MSICDSetup;\??\f:\cdriver.sys --> f:\CDriver.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [31.10.2009 11:38 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [31.10.2009 11:38 8320]
S3 SASENUM;SASENUM;\??\c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASENUM.SYS --> c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASENUM.SYS [?]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
IE: &Stáhnout &vše FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\System32\imon.dll
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Joe\Data aplikací\Mozilla\Firefox\Profiles\htqv7qn3.default\
FF - prefs.js: browser.search.selectedEngine - Google Search Community
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - component: c:\program files\Mozilla Firefox\components\GooglePlusVideosXPCOM.dll
FF - component: c:\program files\Mozilla Firefox\components\SiteVacuumXPCOM.dll
FF - component: c:\program files\Mozilla Firefox\components\SuperSearchXPCOM.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.
- - - - NEPLATNÉ POLOŽKY ODSTRANĚNÉ Z REGISTRU - - - -

Toolbar-{0508F8F1-08E3-43EE-AAA8-09AD09803084} - (no file)
MSConfigStartUp-Steam - d:\program files\Valve\Steam\Steam.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-16 10:01
Windows 5.1.2600 Service Pack 3 NTFS

skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll >>UNKNOWN [0x8A34A630]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xba0ecf28
\Driver\ACPI -> ACPI.sys @ 0xb9f59cb8
\Driver\atapi -> 0x8a34a630
IoDeviceObjectType -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntkrnlpa.exe @ 0x805836a8
ParseProcedure -> ntkrnlpa.exe @ 0x805827e8
Warning: possible MBR rootkit infection !
user & kernel MBR OK

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="9EB55D21D9570D27012F1C33CD3FBFA9A
643B0E0DE8973C09DC32FD1F94F2F59859FE7C64BC5B60A9647B136E7AF36EDFCA38
A7AD2D6CC22FE2001884CA1E1BE753A703B71AAC26F98AE11AEAE741C138F2CD0A8
7D23C26F621B7F15F7D0BB71AC73CF9236672E8328A4A007818F0FEC850A96CED331
294514F38EF42702F077383B568118A0AA533AE93B4E54475932D87064F3DD878BA43
16E8149971B693B7E07C462293F1A531944B0372EA5FD7FD517B7C6B7F1A872AED3A1
5599C9BF09B4CD50B20FF01958DE7DC3982A78B152A0377E15117F7275516D2D03927
EC392E70E24140627701DFD642CEEF6D2DE0FAC101F54AE0390DAB50CD3DFFCFEBC9
E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127
BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB34528EDD5E5BE2F6
E6675D575E7D6A3B9808BEE781E49B4452F9106C735D5E24A94616F017FB1066DC44C
B68E9BD57BFCEC6BA291923193E28E3FBE9EF607DB2123EC31FDC4C0674FDAE041A8
5B0356305AC157EE6DD45D0CC937A078795EB1F84B22D1CBA44B4C971AA7BB37484E
5AA85A2770A2801F4178D45F524C0909051E7129BA31F3AB4BDD27EFD6FAAF75276C
566CF21FACE0423D8C99DD083B758A5C3E321A559DC229AE5849EB8041A689FE0C4C
FCD63DCD077C30564571C46B16EC5BF124520A91F1C8EAA32B0BFCF997015A16E4DC
794BE0C85ED02AE3AC9116F3ED486598DF4CFF658F2512CFDD2DCA84675661274B53
34E7A93F18773276D6222E159EE1DE6DB4FF0F35933C72FAA7A7BC9B44098CF999BA
21472C33F1343F30BBE2B44B27AF0C0A9586B020646010DDFC01CB1C7C961CBA1248
77A7A99924635D261CC1201BE58F85EEC8A064BE0FAC08A22F3F8DC7B233F0BF67466985DEC011C23B1E49CFA18F7D785EF7CC8D0D491EE124988965F60E7284D3225432D72742C5CCCB7C55D7565AAA48AFE9ADA1CE9CA7926B45A87322A68D8E5C0218BD13927BD2E7DC8A35CA2D27AE608F10B48050D2A3421DB733DBBD2AD74268B0A7D99C8BA980BC40D29B5DC7B47F454F34540B7B952D5A6A418F2FDA17A24323B5B885B8C8599AC5F2F48EBE19E89182BF01F630490BD17A2D1CC15D0467097B7C19A42AF9EC6CA63B3A8B42A966B6CCA9EC93AA635A860F667685B1B5822129A0087F162459338E4EFC984168AA4D1EF168AFC82B9C986B14E8B23A169374E03572E72298AE6663592BFB6AA8BA41BBC114E7C3F4B3765E4ED1BD54D648FC8947A8E644DB80897A8BE443F305D3D73D63F2B23474BEE2927A2A56E4864EDD5F7944DF55BC825E51809B72434F9A55767C4D5E94750CED3133DD8FD82BF7D1B5841326DA16C50BA5F7B1A7F080DF6959BB6296131A29ABAC6800BA72F7AC8946693ACA43685FD"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(840)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(896)
c:\windows\System32\imon.dll
c:\program files\Eset\pr_imon.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Eset\nod32krn.exe
c:\windows\System32\oodag.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wdfmgr.exe
c:\windows\System32\wbem\wmiapsrv.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Celkový čas: 2010-03-16 10:02:52 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-16 09:02

Před spuštěním: Volných bajtů: 12 644 491 264
Po spuštění: Volných bajtů: 12 653 215 744

WindowsXP-KB310994-SP2-Pro-BootDisk-CSY.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn /usepmtimer

- - End Of File - - DE19405072CFDA4CA3477E4FF91247FF

[Caroprd111]

Pokud nemáte, přesuňte Combofix na plochu

• Otevřete si Poznámkový blok a zkopírujte do něj text z bílého okénka.

Kód: Vybrat vše

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

Driver::
CEMXKDEP
cpuz130
HFVKRQU

File::
c:\docume~1\Joe\LOCALS~1\Temp\CEMXKDEP.exe 
c:\docume~1\Joe\LOCALS~1\Temp\cpuz130\cpuz_x32.sys 
c:\docume~1\Joe\LOCALS~1\Temp\HFVKRQU.exe 

• Uložte Vámi vytvořený TXT soubor jako CFScript.txt na plochu
• Po uložení uchopte vámi vytvořený skript levým myšítkem a přesuňte ho nad ikonu Combofixu, kde ho upustíte:
  
  
• Po aplikaci na Vás vypadne další log,vložte ho sem

Může se stát, že po aplikaci skriptu a restartu Windows nenaběhnou, v tom případě znovu restartujte a přitom mačkejte F8, pak zvolte Poslední známou funkční konfiguraci

[atharix]

ComboFix 10-03-15.04 - Joe 16.03.2010 14:34:59.2.3 - x86
Systém Microsoft Windows XP Professional 5.1.2600.3.1250.420.1029.18.2047.1633 [GMT 1:00]
Spuštěný z: c:\documents and settings\Joe\Plocha\ComboFix.exe
Použité ovládací přepínače :: c:\documents and settings\Joe\Plocha\CFScript.txt
AV: Eset NOD32 Antivirus 2.70 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
* Rezidentní štít AV je zapnutý


FILE ::
"c:\docume~1\Joe\LOCALS~1\Temp\CEMXKDEP.exe"
"c:\docume~1\Joe\LOCALS~1\Temp\cpuz130\cpuz_x32.sys"
"c:\docume~1\Joe\LOCALS~1\Temp\HFVKRQU.exe"
.

((((((((((((((((((((((((((((((((((((((( Ostatní výmazy )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\etc\lmhosts

.
((((((((((((((((((((((((((((((((((((((( Ovladače/Služby )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CEMXKDEP
-------\Legacy_CPUZ130
-------\Legacy_HFVKRQU
-------\Service_CEMXKDEP
-------\Service_cpuz130
-------\Service_HFVKRQU


((((((((((((((((((((((((( Soubory vytvořené od 2010-02-16 do 2010-03-16 )))))))))))))))))))))))))))))))
.

2010-03-15 11:40 . 2010-03-15 11:40 -------- d-----w- c:\windows\system32\oodag
2010-03-15 10:52 . 2008-04-14 07:51 136192 ------w- c:\windows\system32\aaclient.dll
2010-03-15 10:47 . 2008-04-14 07:51 33792 -c----w- c:\windows\system32\dllcache\custsat.dll
2010-03-15 10:44 . 2008-04-13 23:10 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys
2010-03-15 09:45 . 2010-03-15 09:45 -------- d-----w- c:\program files\Zone Labs
2010-03-15 09:45 . 2010-03-16 13:39 -------- d-----w- c:\windows\Internet Logs
2010-03-15 09:23 . 2010-03-15 09:23 -------- d--h--w- c:\windows\PIF
2010-03-15 09:05 . 2010-03-15 09:05 -------- d-----r- c:\documents and settings\LocalService\Dokumenty
2010-03-14 19:37 . 2010-03-15 00:45 -------- d-----w- c:\program files\WinClamAVShield
2010-03-14 19:30 . 2010-03-14 19:30 -------- d-----w- c:\program files\Crawler
2010-03-14 19:30 . 2010-03-14 19:30 142592 ----a-w- c:\windows\system32\drivers\sp_rsdrv2.sys
2010-03-14 19:29 . 2010-03-15 09:53 -------- d-----w- c:\program files\Spyware Terminator
2010-03-08 22:49 . 2010-03-14 21:53 211893 ----a-w- c:\windows\system32\drivers\IsDrv122.sys
2010-03-08 22:44 . 2010-03-08 22:44 94480 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-03-06 16:56 . 2010-03-12 22:53 -------- d-----w- c:\program files\trend micro
2010-03-06 16:56 . 2010-03-06 16:56 -------- d-----w- C:\rsit

.
(((((((((((((((((((((((((((((((((((((((( Find3M výpis ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-16 13:32 . 2010-03-15 11:10 2468868 ----a-w- c:\windows\Internet Logs\tvDebug.Zip
2010-03-16 08:50 . 2009-10-15 17:49 -------- d-----w- c:\program files\ESET
2010-03-16 08:40 . 2010-03-16 08:54 8704 ----a-w- c:\windows\Internet Logs\xDB2.tmp
2010-03-15 23:15 . 2010-03-16 08:40 103424 ----a-w- c:\windows\Internet Logs\xDB1.tmp
2010-03-15 21:04 . 2001-10-25 12:00 68940 ----a-w- c:\windows\system32\perfc005.dat
2010-03-15 21:04 . 2001-10-25 12:00 389994 ----a-w- c:\windows\system32\perfh005.dat
2010-03-15 10:55 . 2009-10-15 17:30 86327 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-03-15 10:55 . 2009-10-15 17:30 3038 ----a-w- c:\windows\PCHealth\HelpCtr\PackageStore\SkuStore.bin
2010-03-15 10:34 . 2009-10-15 19:16 -------- d-----w- c:\program files\FlashGet
2010-03-15 09:48 . 2010-03-15 09:48 4212 ---ha-w- c:\windows\system32\zllictbl.dat
2010-02-24 21:03 . 2009-11-01 09:45 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-01-25 00:25 . 2009-10-15 17:57 -------- d-----w- c:\program files\QuickTime
2010-01-25 00:25 . 2010-01-25 00:25 -------- d-----w- c:\program files\Common Files\Apple
2010-01-25 00:25 . 2010-01-25 00:25 -------- d-----w- c:\program files\Apple Software Update
2010-01-19 17:02 . 2009-10-31 10:38 -------- d-----w- c:\program files\Common Files\Nokia
2010-01-19 17:02 . 2009-10-31 10:38 -------- d-----w- c:\program files\Nokia
2010-01-19 17:02 . 2010-01-19 17:02 -------- d-----w- c:\program files\MSXML 6.0
2009-12-17 00:47 . 2009-12-17 00:42 967 ----a-w- c:\windows\ScUnin.pif
2009-12-17 00:47 . 2009-12-17 00:42 94208 ----a-w- c:\windows\ScUnin.exe
2009-12-17 00:47 . 2009-12-17 00:42 27961 ----a-w- c:\windows\scunin.dat
2009-04-07 18:52 . 2009-04-07 18:52 28672 ----a-w- c:\program files\mozilla firefox\components\GooglePlusVideosXPCOM.dll
2008-10-19 09:58 . 2008-10-19 09:58 49152 ----a-w- c:\program files\mozilla firefox\components\SiteVacuumXPCOM.dll
2009-08-09 21:14 . 2009-08-09 21:14 49152 ----a-w- c:\program files\mozilla firefox\components\SuperSearchXPCOM.dll
2008-08-16 16:42 . 2008-08-16 16:42 13112 ----a-w- c:\program files\mozilla firefox\plugins\cgpcfg.dll
2008-08-16 16:42 . 2008-08-16 16:42 70456 ----a-w- c:\program files\mozilla firefox\plugins\CgpCore.dll
2008-08-16 16:42 . 2008-08-16 16:42 91448 ----a-w- c:\program files\mozilla firefox\plugins\confmgr.dll
2008-08-16 16:42 . 2008-08-16 16:42 20800 ----a-w- c:\program files\mozilla firefox\plugins\ctxlogging.dll
2008-08-16 16:43 . 2008-08-16 16:43 206136 ----a-w- c:\program files\mozilla firefox\plugins\ctxmui.dll
2008-08-16 16:42 . 2008-08-16 16:42 31032 ----a-w- c:\program files\mozilla firefox\plugins\icafile.dll
2008-08-16 16:42 . 2008-08-16 16:42 40248 ----a-w- c:\program files\mozilla firefox\plugins\icalogon.dll
2008-05-21 07:41 . 2008-05-21 07:41 479232 ----a-w- c:\program files\mozilla firefox\plugins\msvcm80.dll
2008-05-21 07:41 . 2008-05-21 07:41 548864 ----a-w- c:\program files\mozilla firefox\plugins\msvcp80.dll
2008-05-21 07:41 . 2008-05-21 07:41 626688 ----a-w- c:\program files\mozilla firefox\plugins\msvcr80.dll
2008-06-05 12:58 . 2008-06-05 12:58 648504 ----a-w- c:\program files\mozilla firefox\plugins\sslsdk_b.dll
2008-08-16 16:42 . 2008-08-16 16:42 23864 ----a-w- c:\program files\mozilla firefox\plugins\TcpPServ.dll
.

((((((((((((((((((((((((((((( SnapShot@2010-03-16_09.00.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-16 13:39 . 2010-03-16 13:39 16384 c:\windows\Temp\Perflib_Perfdata_7fc.dat
.
(((((((((((((((((((((((((((((((((( Spouštěcí body v registru )))))))))))))))))))))))))))))))))))))))))))))
.
.
*Poznámka* prázdné záznamy a legitimní výchozí údaje nejsou zobrazeny.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-10-15 949376]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-11-22 1037192]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0OODBS

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 10:08 935288 ----a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 02:08 35696 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2008-04-14 07:52 15360 ------w- c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
2004-08-22 15:05 81920 ----a-w- c:\program files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flashget]
2007-06-29 11:44 1990704 ----a-w- c:\program files\FlashGet\flashget.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
2007-03-01 13:57 153136 ----a-w- c:\program files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OODefragTray]
2007-05-11 00:08 2512392 ----a-w- c:\windows\system32\oodtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
2009-06-25 14:12 1414144 ----a-w- c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-09-05 00:54 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegDoctor]
2005-11-30 16:31 2260992 ----a-w- c:\program files\RegDoctor\RegDoctor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
2004-11-02 18:24 32768 ----a-w- c:\program files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminator]
2010-03-14 19:30 2166784 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorShield.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpywareTerminatorUpdate]
2010-03-14 19:30 3037696 ----a-w- c:\program files\Spyware Terminator\SpywareTerminatorUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2009-10-18 22:52 149280 ----a-w- c:\program files\Java\jre6\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\FlashGet\\FlashGet.exe"=
"d:\\Strong DC++\\StrongDC.exe"=
"c:\\Program Files\\QIP\\qip.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\Nokia\\Nokia Software Updater\\nsu_ui_client.exe"=
"c:\\Program Files\\Common Files\\Nokia\\Service Layer\\A\\nsl_host_process.exe"=
"c:\\Program Files\\Spyware Terminator\\SpywareTerminatorUpdate.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 d347bus;d347bus;c:\windows\system32\drivers\d347bus.sys [15.10.2009 18:55 155136]
R0 d347prt;d347prt;c:\windows\system32\drivers\d347prt.sys [15.10.2009 18:55 5248]
R1 nod32drv;nod32drv;c:\windows\system32\drivers\nod32drv.sys [15.10.2009 18:50 15424]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [14.3.2010 20:30 142592]
R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine;c:\program files\LogMeIn Hamachi\hamachi-2.exe [29.10.2009 12:27 1074568]
S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS --> c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASDIFSV.SYS [?]
S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.sys --> c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASKUTIL.sys [?]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [15.10.2009 18:39 1684736]
S3 MSICDSetup;MSICDSetup;\??\f:\cdriver.sys --> f:\CDriver.sys [?]
S3 nmwcdnsu;Nokia USB Flashing Phone Parent;c:\windows\system32\drivers\nmwcdnsu.sys [31.10.2009 11:38 136704]
S3 nmwcdnsuc;Nokia USB Flashing Generic;c:\windows\system32\drivers\nmwcdnsuc.sys [31.10.2009 11:38 8320]
S3 SASENUM;SASENUM;\??\c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASENUM.SYS --> c:\docume~1\Joe\LOCALS~1\Temp\SAS_SelfExtract\SASENUM.SYS [?]
.
.
------- Doplňkový sken -------
.
uStart Page = hxxp://www.msn.com
mStart Page = hxxp://www.msn.com
IE: &Stáhnout &vše FlashGetem - c:\program files\FlashGet\jc_all.htm
IE: &Stáhnout FlashGetem - c:\program files\FlashGet\jc_link.htm
IE: Crawler Search - tbr:iemenu
IE: E&xportovat do aplikace Microsoft Office Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
LSP: c:\windows\System32\imon.dll
Handler: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - c:\progra~1\Crawler\Toolbar\ctbr.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Joe\Data aplikací\Mozilla\Firefox\Profiles\htqv7qn3.default\
FF - prefs.js: browser.search.selectedEngine - Google Search Community
FF - prefs.js: browser.startup.homepage - hxxp://www.seznam.cz/
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xcomm.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xshared.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xsupport.dll
FF - component: c:\program files\Crawler\Toolbar\firefox\components\xwsg.dll
FF - component: c:\program files\Mozilla Firefox\components\GooglePlusVideosXPCOM.dll
FF - component: c:\program files\Mozilla Firefox\components\SiteVacuumXPCOM.dll
FF - component: c:\program files\Mozilla Firefox\components\SuperSearchXPCOM.dll
FF - component: c:\program files\Nokia\Nokia PC Suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npicaN.dll

---- NASTAVENÍ FIREFOXU ----
c:\program files\Mozilla Firefox\defaults\pref\firefox-l10n.js - pref("browser.fixup.alternate.suffix", ".cz");
.

**************************************************************************
skenování skrytých procesů ...

skenování skrytých položek 'Po spuštění' ...

skenování skrytých souborů ...

sken byl úspešně dokončen
skryté soubory:

**************************************************************************
.
--------------------- ZAMKNUTÉ KLÍČE V REGISTRU ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="9EB55D21D9570D27012F1C33CD3FBFA9A643B0E0DE8973C09DC32FD1F94F2F59859FE7C64BC5B60A9647B136E7AF36EDFCA38A7AD2D6CC22FE2001884CA1E1BE753A703B71AAC26F98AE11AEAE741C138F2CD0A87D23C26F621B7F15F7D0BB71AC73CF9236672E8328A4A007818F0FEC850A96CED331294514F38EF42702F077383B568118A0AA533AE93B4E54475932D87064F3DD878BA4316E8149971B693B7E07C462293F1A531944B0372EA5FD7FD517B7C6B7F1A872AED3A15599C9BF09B4CD50B20FF01958DE7DC3982A78B152A0377E15117F7275516D2D03927EC392E70E24140627701DFD642CEEF6D2DE0FAC101F54AE0390DAB50CD3DFFCFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB34528EDD5E5BE2F6E6675D575E7D6A3B9808BEE781E49B4452F9106C735D5E24A94616F017FB1066DC44CB68E9BD57BFCEC6BA291923193E28E3FBE9EF607DB2123EC31FDC4C0674FDAE041A85B0356305AC157EE6DD45D0CC937A078795EB1F84B22D1CBA44B4C971AA7BB37484E5AA85A2770A2801F4178D45F524C0909051E7129BA31F3AB4BDD27EFD6FAAF75276C566CF21FACE0423D8C99DD083B758A5C3E321A559DC229AE5849EB8041A689FE0C4CFCD63DCD077C30564571C46B16EC5BF124520A91F1C8EAA32B0BFCF997015A16E4DC794BE0C85ED02AE3AC9116F3ED486598DF4CFF658F2512CFDD2DCA84675661274B5334E7A93F18773276D6222E159EE1DE6DB4FF0F35933C72FAA7A7BC9B44098CF999BA21472C33F1343F30BBE2B44B27AF0C0A9586B020646010DDFC01CB1C7C961CBA124877A7A99924635D261CC1201BE58F85EEC8A064BE0FAC08A22F3F8DC7B233F0BF67466985DEC011C23B1E49CFA18F7D785EF7CC8D0D491EE124988965F60E7284D3225432D72742C5CCCB7C55D7565AAA48AFE9ADA1CE9CA7926B45A87322A68D8E5C0218BD13927BD2E7DC8A35CA2D27AE608F10B48050D2A3421DB733DBBD2AD74268B0A7D99C8BA980BC40D29B5DC7B47F454F34540B7B952D5A6A418F2FDA17A24323B5B885B8C8599AC5F2F48EBE19E89182BF01F630490BD17A2D1CC15D0467097B7C19A42AF9EC6CA63B3A8B42A966B6CCA9EC93AA635A860F667685B1B5822129A0087F162459338E4EFC984168AA4D1EF168AFC82B9C986B14E8B23A169374E03572E72298AE6663592BFB6AA8BA41BBC114E7C3F4B3765E4ED1BD54D648FC8947A8E644DB80897A8BE443F305D3D73D63F2B23474BEE2927A2A56E4864EDD5F7944DF55BC825E51809B72434F9A55767C4D5E94750CED3133DD8FD82BF7D1B5841326DA16C50BA5F7B1A7F080DF6959BB6296131A29ABAC6800BA72F7AC8946693ACA43685FD"
.
--------------------- Knihovny navázané na běžící procesy ---------------------

- - - - - - - > 'winlogon.exe'(836)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'lsass.exe'(892)
c:\windows\System32\imon.dll
c:\program files\Eset\pr_imon.dll
.
------------------------ Jiné spuštené procesy ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Eset\nod32krn.exe
c:\windows\System32\oodag.exe
c:\program files\Spyware Terminator\sp_rsser.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wscntfy.exe
c:\windows\System32\wbem\wmiapsrv.exe
.
**************************************************************************
.
Celkový čas: 2010-03-16 14:41:23 - počítač byl restartován
ComboFix-quarantined-files.txt 2010-03-16 13:41
ComboFix2.txt 2010-03-16 09:02

Před spuštěním: Volných bajtů: 12 622 348 288
Po spuštění: Volných bajtů: 12 579 336 192

- - End Of File - - 6D33B1CE0CA8CDD42177520490EA9020

[Caroprd111]

Odinstalujte všechny emulátory virtuálních mechanik.

Stáhněte SPTD http://www.duplexsecure.com/en/downloads

• Vyberte verzi podle svého operačního systému (64 & 32b). Uložte na plochu a spusťte.
• zvolte možnost Uninstall a restartujte PC.

Stáhněte a spusťte http://www.jpshortstuff.247fixes.com/Defogger.exe

• Klikněte na "Disable" a restartujte PC.

Stáhněte MBR na plochu http://www2.gmer.net/mbr/mbr.exe

Start > Spustit (Win + R)

• Vyskočí okénko, zkopírujte do něj:

Kód: Vybrat vše

"%userprofile%\plocha\mbr" -t

• Klikněte na OK

• Vytvoří se log s názvem mbr.log, vložte ho sem.

Dejte log z Gmer http://www.viry.cz/forum/viewtopic.php?f=29&t=62878

[atharix]

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
kernel: MBR read successfully
user & kernel MBR OK

GMER jdu spustit nyní. U SPTD bylo jen install , uninstall nesvítilo nechal jsem to tudíž tak a pokračoval.

[Caroprd111]

OK